russell@unturf.com aeb084c9ae feat: add 30 outreach docs (batches 9-10)

Batch 9 (15): bun, bzflag (3), cake_wallet (4), calligra, caprice32 (2),
  cataclysm (3), cemu
Batch 10 (15): cemu-0002, citra, clickhouse-java, cmake (3), cocos2d (3),
  conduit, cura (2), curaengine, clamav, contiki

2026-04-14 19:51:36 -04:00

2.8 KiB

Raw Blame History

Cataclysm: DDA — CWE-407 Disclosure Brief (cataclysm-0003)

2026-04-14 · Patch available — awaiting upstream merge

Finding

One O(n²) defect in Cataclysm: DDA's surroundings menu. The item_tab_data::add_item_recursive() and terfurn_tab_data::add_terfurn() functions use std::find on a std::vector<std::string> to deduplicate item and terrain/furniture names. Fires when opening the surroundings menu ('V' key) in areas with many items or terrain features.

The Defect

cataclysm-0003 (PATCHED — MEDIUM): src/surroundings_menu.cpp:241,585

// In add_item_recursive() — fires per item in surroundings:
const std::string name = it->tname();
if (std::find(item_order.begin(), item_order.end(), name)
    == item_order.end()) {  // O(I) per item
    item_order.push_back(name);
    items[name] = map_entity_stack<item>(it, relative_pos, it->count());
}

The same pattern appears in add_terfurn() for terrain and furniture entries. Each new item or terrain feature scans the growing order vector for duplicates.

Complexity Proof

At I=500 unique items in surroundings:

Defective: 500 insertions × average 250 comparisons = ~125,000 string comparisons
Fixed: 500 insertions × O(1) = 500 set lookups
~250× op reduction. Fires on every surroundings menu open.

Impact

Cataclysm: DDA features complex environments with many items scattered across the map. Loot-dense areas (cities, laboratories, military installations) can have hundreds of unique items in the player's surroundings. Opening the surroundings menu in these areas causes a visible pause as the item list builds with quadratic dedup cost.

The Fix

Add std::unordered_set<std::string> class members for O(1) dedup:

// Before
if (std::find(item_order.begin(), item_order.end(), name) == item_order.end())
    item_order.push_back(name);

// After
// CWE-407 fix: unordered_set for O(1) name dedup.
if (item_order_set.find(name) == item_order_set.end()) {
    item_order.push_back(name);
    item_order_set.insert(name);
}

Patch

Fix available: defects/cataclysm-0003/patch/cataclysm-0003.patch

Single-file patch on src/surroundings_menu.cpp. Adds item_order_set as a class member to both item_tab_data and terfurn_tab_data, used for O(1) dedup in add_item_recursive() and add_terfurn().

What We Ask

A patch is ready for review.

Confirm receipt and assign a GitHub issue reference (CleverRaven/Cataclysm-DDA).
Assess severity — fires on every surroundings menu open, visible pause in loot-dense areas.
Coordinate a disclosure date — we target 90 days from first contact.
We will credit the Cataclysm: DDA team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.8 KiB Raw Blame History Unescape Escape